Newsgroups: comp.risks
X-issue: 9.81
Date: Fri, 13 Apr 90 22:16:19 EDT
From: henry@zoo.toronto.edu
Subject: Shuttle roll incident on January '90 mission

As many people know, during the LDEF retrieval mission in January 1990, at one
point when the crew were asleep, a garbled "state vector" uploaded to Columbia
caused the orbiter to start rotating.  The extent of this has been somewhat
exaggerated -- maximum speed was half an RPM, and the crew didn't notice until
Mission Control woke them up -- but it was a bit startling that such a thing
could happen.  It could have been serious if it had happened at a worse time.

Most software people, on hearing about, react with "haven't those clods ever
heard of checksums?".  Well, it turns out they have.  In the latest issue of
World Spaceflight News (an excellent source for serious technical detail on
shuttle flights), the full story is given.  The telemetry channels were noisy
at the time, the state vector was garbled by several noise "hits", and Mission
Control's computers correctly announced that the copy sent back by the orbiter
for confirmation didn't match the original and the state vector should be
discarded.  The ground controller responsible for the matter examined the
detailed report, incorrectly decided that nothing important had been damaged --
and ordered the orbiter's computers to begin using the defective state vector!
The orbiter, naturally, obeyed.  In other words, this was ultimately operator
error.  The controller's action was "clearly outside the expected" procedures.
(The question of whether this sort of thing is routine practice was not
addressed, but I for one would suspect that the controller wouldn't have done
that if he hadn't had to use manual overrides before.)

Procedures have been changed as a stopgap, and various long-term fixes are
being considered, including the possibility of "inhibiting" the manual override
in such cases.  (It is not clear whether this means making it impossible, or
just requiring some degree of confirmation or authorization.)

          Henry Spencer at U of Toronto Zoology        uunet!attcan!utzoo!henry

From: Mary Shafer <shafer@rigel.dfrc.nasa.gov>
Newsgroups: sci.space.shuttle
Subject: Re: Question RE landings
Date: 03 Feb 2000 11:41:40 -0800

Tom <t2jr@bellsouth.net> writes:

> Andy wrote:
> >
> > << If all computers fail they're completely SOL... The guidance requirements
> > are too complex for human control. They've tried failing the computers in
> > simulators and the shuttle immediately spirals out of control and does a Lawn
> > Dart... >>

The Orbiter is FBW, so without the computers there's no connection
between the pilot input and the control surfaces.  However, the
re-entry can be hand-flown (and was) with the FCS providing the usual
augmentation.  Although normally the re-entry profile is flown by the
FCS, with the pilot hands-off, down to just before the HAC, it's
possible to let the autoland function land the airplane, making the
entire re-entry automatic or to hand-fly the entire re-entry so long
as the FCS is providing augmentation and the FBW is connecting the
inputs to the control jets and surfaces.

> > Tom, I'm not clear on what you're saying here. What phase of flight are you
> > talking about? For that matter, what phase was the original question about?
> > I've "flown" sims with crews where they've manually flown the orbiter
> > (following reentry, of course) through the S-turns, all the way down to the HAC
> > and landing.
>
> Mostly the entry phase down to transonic. But, they are not "manually"
> flying the orbiter. They are instructing the computer where to maneuver
> the orbiter instead of the computer figuring it out itself. They do not
> directly control the orbiter.

After the first S-turn on STS-1, the entire re-entry was hand-flown
through STS-4, at which point the FCS was rewritten (and the e-seats
removed).  John Young took over the flying when the sideslip meter
pegged and stayed pegged for several seconds, meaning that the limit
had been exceeded.  This happened because L_YJ was about half the size
predicted and the wrong sign and not even the extremely robust FCS
could deal with that much error.  Cf Iliff & Shafer, "Extraction of
Stability and Control Derivatives From Orbiter Flight Data", NASA
TM-4500, June, 1993.

Starting with STS-5, the re-entry was flown automatically by the FCS
down to just before the HAC, about Mach 1 or 2.  It hasn't been
hand-flown since STS-4 and probably won't be unless the primary FCS
fails and the Orbiter is in reversionary mode or using the backup FCS.
It takes two or three (n-1, to be precise, where n is the number of
primary FCS computers) computer failures to go to a reversionary mode,
I believe, and all primary FCS computers have to fail to go to the
backup FCS.

> For instance, at about the mach 20 point, if the commander commands a
> right roll the orbiter actually commands a left yaw - the side effect of
> which is falling off on the right wing. The commander is merely telling
> the computer "I want to go here" and the computer figures out which
> surfaces to move to get there. This dynamically changes with speed,
> angle of attack, and altitude and is too complex and subtle for a human
> to be able to control.

Rolling into and out of the energy-management maneuver was supposed to
be automatic throughout the program, but wasn't at the beginning.
These days, the pilot takes control of the airplane somewhere around
Mach 1 or 2, shortly before the HAC.  From then on, the airplane is
hand-flown.  The FCS offers the usual SAS or CAS augmentation, but all
inputs are initiated by the pilot, unlike the pre-programmed re-entry
profile, which is flown by the FCS, with the pilot hands-off.

--
Mary Shafer    http://www.dfrc.nasa.gov/People/Shafer/mary.html
shafer@rigel.dfrc.nasa.gov     Of course I don't speak for NASA
Senior Handling Qualities Research Engineer
NASA Dryden Flight Research Center, Edwards, CA
For non-aerospace mail, use shafer@spdcc.com please

From: Mary Shafer <shafer@rigel.dfrc.nasa.gov>
Newsgroups: sci.space.shuttle
Subject: Re: Question RE landings
Date: 03 Feb 2000 16:57:58 -0800

aseed@aol.comxnospamx (Andy) writes:

> << After the first S-turn on STS-1, the entire re-entry was hand-flown >>
>
> I always love Mary's descriptions :-).

If I had a better memory and a lot more nerve, I'd post John Young's
actual remarks when he saw that sideslip needle peg at four degrees
for three or four seconds.  I'll see if my co-author can remember what
John had to say in the post-flight debrief (and if I can make it
public).  Everyone was pretty excited about exceeding the sideslip
limit because it meant that the stagnation point (i.e. hot spot) moved
off the nosecap, after all.

This sideslip was more than twice the sideslip predicted.  It also
took a minute for the FCS to damp out the oscillation, showing how
robust the FCS design was.  Incidentally, the velocity was 24,300 fps
and qbar was 12 psf.  Apparently, the area around the nosecap wasn't
instrumented, as we didn't mention any temperatures associated with
this excursion.

The reason L_YJ was wrongly predicted was because the flow field
around the side-jet exhaust was not as expected because it couldn't be
properly simulated in the wind tunnel.  At high altitudes, the vehicle
angle of attack is about 40 deg, causing flow separation on the upper
surface of the wing.  When the RCS side jets are fired, the exhaust
enters this separated flow region and pressurized th volume defined by
the wing upper surfaces and the flow-separation wake boundaries.
There are similar overpredictions, for the same reason, for the
up-and-down-firing jets used for pitch and roll commands at low
dynamic pressures.  Cf Iliff and Shafer, "Space Shuttle Hypersonic
Aerodynamic and Aerothermodynamic Flight Research and the Comparison
to Ground Test Results", NASA TM-4499, June, 1993, which has a good
bibliography that will point the interested reader to more detailed
explanations.

--
Mary Shafer    http://www.dfrc.nasa.gov/People/Shafer/mary.html
shafer@rigel.dfrc.nasa.gov     Of course I don't speak for NASA
Senior Handling Qualities Research Engineer
NASA Dryden Flight Research Center, Edwards, CA
For non-aerospace mail, use shafer@spdcc.com please

From: Mary Shafer <shafer@rigel.dfrc.nasa.gov>
Newsgroups: sci.space.shuttle
Subject: Re: Question RE landings
Date: 04 Feb 2000 12:19:01 -0800

"Reed Snellenberger" <reed.snellenberger@aspentech.com> writes:

> Mary Shafer <shafer@rigel.dfrc.nasa.gov> wrote in message
> news:u0ln51kcmh.fsf@rigel.dfrc.nasa.gov...
> >
> > If I had a better memory and a lot more nerve, I'd post John Young's
> > actual remarks when he saw that sideslip needle peg at four degrees
> > for three or four seconds.  I'll see if my co-author can remember what
> > John had to say in the post-flight debrief (and if I can make it
> > public).  Everyone was pretty excited about exceeding the sideslip
> > limit because it meant that the stagnation point (i.e. hot spot) moved
> > off the nosecap, after all.

> Thanks for posting this (if you can) -- it's sort of the "unseen"
> story for most people, but I think it's interesting...

I feel very privileged to have worked on the Orbiter from the inside,
even as little as I did.  When I started at Dryden, working as a
summer hire while I was in college, we were flying the X-15 and
lifting bodied and people were very kind in making sure I got to see
what was happening, so I was lucky to see the forerunners to the
Orbiter as well as the Orbiter.

> I wonder whether this had anything to do with how jazzed Young
> appeared to be during his post-landing walkaround...

Bouncy and ebullient, wasn't he?  I always put it down to him having a
tiny, niggling doubt that it would really work the way it was supposed
to, as demonstrated by that first energy-management S-turn, so that by
landing it he'd triumphed.  There's also a certain pure pleasure in
survival, which the pilots of successful first flights often
demonstrate.

I really admire John Young; he's a real golden arm pilot and
everything you'd want in a test pilot--smart, understands the
engineering, knows the difficulties, trusts the engineers, and has a
tremendous sense of humor.  I worked with him on a couple of in-flight
simulation programs where we were trying to improve the Orbiter flying
qualities and it was always a pleasure.

--
Mary Shafer    http://www.dfrc.nasa.gov/People/Shafer/mary.html
shafer@rigel.dfrc.nasa.gov     Of course I don't speak for NASA
Senior Handling Qualities Research Engineer
NASA Dryden Flight Research Center, Edwards, CA
For non-aerospace mail, use shafer@spdcc.com please

From: Mary Shafer <shafer@rigel.dfrc.nasa.gov>
Newsgroups: sci.space.shuttle
Subject: Re: Question RE landings
Date: 04 Feb 2000 12:10:07 -0800

"Dan Parker" <dparker@stanford.edu> writes:

> Mary Shafer <shafer@rigel.dfrc.nasa.gov> wrote in message
> news:u0zotijcp7.fsf@rigel.dfrc.nasa.gov...
> > After the first S-turn on STS-1, the entire re-entry was hand-flown
> > through STS-4, at which point the FCS was rewritten (and the e-seats
> > removed).  John Young took over the flying when the sideslip meter
> > pegged and stayed pegged for several seconds, meaning that the limit
> > had been exceeded.  This happened because L_YJ was about half the size
> > predicted and the wrong sign and not even the extremely robust FCS
> > could deal with that much error.  Cf Iliff & Shafer, "Extraction of
> > Stability and Control Derivatives From Orbiter Flight Data", NASA
> > TM-4500, June, 1993.
>
> For the first-year grad students among us, what's L_YJ?? :-)

Why, it's rolling moment due to yaw jet.  I can tell you didn't track
down the reference, which explains it all in excruciating detail,
originally keyed in in LaTeX by yours truly, who managed to get
tangled up in the layers of subscripts more than once.  It's quite
amazing how odd something can look if just one closing command is
omitted.  Some of those equations were almost funny, they were so bad
when I made a tiny omission.  Then there's trying to put subscripted
variables into figure captions, which involved using \box, if I recall
correctly (I've tried to put it out of my mind, but I'm working on an
expanded version of the hypersonic aerothermodynamics paper now and
can't really ignore this).

There are some extra terms in the B matrix (of course you remember
x-dot = A x + B u, the state-space form) because the Orbiter has an
RCS for use where q-bar is too low for the aerodynamic control
surfaces to work.  The orbiter has up- and down-firing jets for roll
and pitch control, plus yaw jets for yaw, and the ensuing roll,
control.  The up- and down-firing jets were only used at the beginning
of the re-entry, with the yaw jets used down to where the aerodynamic
surfaces worked.  The aerodynamic surfaces were used throughout the
re-entry, but the tremendous scatter and large error bounds of the
control effectiveness derivatives make it clear that they weren't
doing much at the beginning of re-entry.

--
Mary Shafer    http://www.dfrc.nasa.gov/People/Shafer/mary.html
shafer@rigel.dfrc.nasa.gov     Of course I don't speak for NASA
Senior Handling Qualities Research Engineer
NASA Dryden Flight Research Center, Edwards, CA
For non-aerospace mail, use shafer@spdcc.com please